Plink

Plink is the command-line connection utility from PuTTY that threat actors repeatedly use as a dual-use SSH tunneling tool rather than bespoke malware. Across the provided reporting, it is used to establish SSH tunnels and reverse tunnels, most commonly to expose or reach internal RDP services, but also to access internal HTTP/IIS services and transfer tools. Observed use cases include tunneling RDP for remote access and lateral movement, creating dedicated conduits into segmented networks, and enabling encrypted SSH-based movement throughout victim environments.

The content links Plink use to multiple threat actors and campaigns. Agrius used Plink to tunnel RDP connections for remote access and lateral movement and in some cases renamed it to systems.exe. In xHunt intrusions at Kuwaiti organizations, operators used the BumbleBee ASPX web shell to execute commands and deploy PuTTY Link (Plink), sometimes renamed RTQ.exe, to create SSH tunnels to internal systems over RDP (TCP 3389) and HTTP (TCP 80); one observed tunnel used external IP 192.119.110[.]194 with credentials bor / 123321, and related infrastructure included 142.11.211[.]79, 91.92.109[.]59, 192.255.166[.]158, backendloop[.]online, bestmg[.]info, windowsmicrosofte[.]online, ns1.backendloop[.]online, and ns2.backendloop[.]online. TEMP.Veles used encrypted SSH-based PLINK tunnels during the C0032 campaign to transfer tools and enable RDP connections throughout the environment. SentinelLabs reported the Iranian-aligned TunnelVision cluster commonly deployed FRPC and Plink, including downloading and executing Plink to tunnel RDP traffic after exploiting VMware Horizon Log4j vulnerabilities. Microsoft also reported Seashell Blizzard / Sandworm-linked activity deploying tunneling utilities such as Chisel, Plink, and rsockstun, including via the LocalOlive web shell.

The content also describes a modified Plink-based backdoor. The file napupdatedb.exe (MD5: BA51F25DB03A66C658D1FD4396F32843) is identified as a modified PLINK/PuTTY executable that initiates an SSH reverse tunnel with embedded credentials from local port 3389 to an attacker-controlled server over TCP 8531. Its embedded configuration stores a semicolon-separated list of Plink command-line arguments containing C2 servers and credentials, and replaces the "*" character in each C2 domain with the infected system’s six-digit local time. In other reporting, actors used renamed Plink binaries such as RTQ.exe and systems.exe for defense evasion.

Victim environments and sectors mentioned in connection with Plink-enabled operations include Kuwaiti organizations, Albanian organizations, Ukrainian entities, and broader targeting of government, telecommunications, energy, oil and gas, shipping, arms manufacturing, and other enterprise networks depending on the actor. Plink itself is not described as self-propagating or inherently persistent in the provided content; its role is as an SSH tunneling utility leveraged by threat actors and, in some cases, modified or renamed to function as a backdoor or covert access mechanism.